nevzheng commented on issue #13083: URL: https://github.com/apache/gravitino/issues/13083#issuecomment-5627241113
Additional blocker found during the follow-up scan: Python GVFS treats an empty credential response as permanently cacheable. After #12983, an empty result can mean the caller lacks USE_SECRET, rather than only that the fileset has no credential provider. In clients/client-python/gravitino/filesystem/gvfs_base_operations.py, _get_credentials_with_cache stores an empty result with TIME_WITHOUT_EXPIRATION and has no credential-cache invalidation path. As a result, a caller denied USE_SECRET can be granted the privilege later and still receive an empty result from the same Python client without another request reaching Gravitino. Recovery currently requires recreating the client or evicting the LRU entry. This was reproduced with sequential server responses of empty then credential: both client calls returned empty and the server was called only once. The policy should therefore be accompanied by a Python cache repair: do not cache empty credential results indefinitely, or give negative entries a bounded TTL, and add a denied -> grant -> successful-vend regression test. This is separate from, and should land with, the Cloud Filesystem authorization-test migration. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
